National Vulnerability Database (NVD) National Vulnerability Database (CVE-2009-2901)

National Cyber Awareness System

Vulnerability Summary for CVE-2009-2901

Original release date:01/28/2010

Last revised:03/07/2013

Source: US-CERT/NIST

Overview

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:N/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Allows unauthorized disclosure of information

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/02/2010)

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2901 This issue did not affect Tomcat versions running on Linux or Solaris systems. This issue is fixed in the tomcat5 and tomcat6 packages released with JBoss Enterprise Web Server 1.0.1 for Windows.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2010-0213

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2010/0213

External Source: CONFIRM

Name: http://tomcat.apache.org/security-6.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-6.html

External Source: CONFIRM

Name: http://tomcat.apache.org/security-5.html

Type: Advisory; Patch Information

Hyperlink:http://tomcat.apache.org/security-5.html

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=902650&view=rev

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?rev=902650&view=rev

External Source: CONFIRM

Name: http://svn.apache.org/viewvc?rev=892815&view=rev

Type: Patch Information

Hyperlink:http://svn.apache.org/viewvc?rev=892815&view=rev

External Source: XF

Name: tomcat-autodeploy-security-bypass(55856)

Hyperlink:http://xforce.iss.net/xforce/xfdb/55856

External Source: CONFIRM

Name: http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

Hyperlink:http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2011-0003.html

External Source: BID

Name: 37942

Hyperlink:http://www.securityfocus.com/bid/37942

External Source: BUGTRAQ

Name: 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/516397/100/0/threaded

External Source: BUGTRAQ

Name: 20100124 [SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/509151/100/0/threaded

External Source: MANDRIVA

Name: MDVSA-2010:177

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

External Source: MANDRIVA

Name: MDVSA-2010:176

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

External Source: UBUNTU

Name: USN-899-1

Hyperlink:http://ubuntu.com/usn/usn-899-1

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4077

Hyperlink:http://support.apple.com/kb/HT4077

External Source: SECTRACK

Name: 1023503

Hyperlink:http://securitytracker.com/id?1023503

External Source: SECUNIA

Name: 43310

Hyperlink:http://secunia.com/advisories/43310

External Source: SECUNIA

Name: 39317

Hyperlink:http://secunia.com/advisories/39317

External Source: SECUNIA

Name: 38541

Hyperlink:http://secunia.com/advisories/38541

External Source: SECUNIA

Name: 38346

Type: Advisory

Hyperlink:http://secunia.com/advisories/38346

External Source: SECUNIA

Name: 38316

Type: Advisory

Hyperlink:http://secunia.com/advisories/38316

External Source: SUSE

Name: openSUSE-SU-2013:0147

Hyperlink:http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html

External Source: SUSE

Name: openSUSE-SU-2012:1701

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html

External Source: SUSE

Name: openSUSE-SU-2012:1700

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

External Source: SUSE

Name: SUSE-SR:2010:008

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html

External Source: APPLE

Name: APPLE-SA-2010-03-29-1

Hyperlink:http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Vulnerable software and versions

Configuration 1

* cpe:/a:apache:tomcat:5.5.0

* cpe:/a:apache:tomcat:5.5.25

* cpe:/a:apache:tomcat:5.5.10

* cpe:/a:apache:tomcat:5.5.1

* cpe:/a:apache:tomcat:5.5.28

* cpe:/a:apache:tomcat:5.5.27

* cpe:/a:apache:tomcat:5.5.9

* cpe:/a:apache:tomcat:5.5.8

* cpe:/a:apache:tomcat:5.5.7

* cpe:/a:apache:tomcat:5.5.6

* cpe:/a:apache:tomcat:5.5.5

* cpe:/a:apache:tomcat:5.5.4

* cpe:/a:apache:tomcat:5.5.17

* cpe:/a:apache:tomcat:5.5.18

* cpe:/a:apache:tomcat:5.5.15

* cpe:/a:apache:tomcat:5.5.16

* cpe:/a:apache:tomcat:5.5.13

* cpe:/a:apache:tomcat:5.5.14

* cpe:/a:apache:tomcat:5.5.11

* cpe:/a:apache:tomcat:5.5.12

* cpe:/a:apache:tomcat:5.5.24

* cpe:/a:apache:tomcat:5.5.3

* cpe:/a:apache:tomcat:5.5.22

* cpe:/a:apache:tomcat:5.5.26

* cpe:/a:apache:tomcat:5.5.23

* cpe:/a:apache:tomcat:5.5.20

* cpe:/a:apache:tomcat:5.5.21

* cpe:/a:apache:tomcat:5.5.19

* cpe:/a:apache:tomcat:5.5.2

* cpe:/a:apache:tomcat:6.0.15

* cpe:/a:apache:tomcat:6.0

* cpe:/a:apache:tomcat:6.0.14

* cpe:/a:apache:tomcat:6.0.6

* cpe:/a:apache:tomcat:6.0.7

* cpe:/a:apache:tomcat:6.0.8

* cpe:/a:apache:tomcat:6.0.9

* cpe:/a:apache:tomcat:6.0.17

* cpe:/a:apache:tomcat:6.0.18

* cpe:/a:apache:tomcat:6.0.1

* cpe:/a:apache:tomcat:6.0.0

* cpe:/a:apache:tomcat:6.0.5

* cpe:/a:apache:tomcat:6.0.4

* cpe:/a:apache:tomcat:6.0.3

* cpe:/a:apache:tomcat:6.0.2

* cpe:/a:apache:tomcat:6.0.13

* cpe:/a:apache:tomcat:6.0.12

* cpe:/a:apache:tomcat:6.0.11

* cpe:/a:apache:tomcat:6.0.10

* cpe:/a:apache:tomcat:6.0.16

* cpe:/a:apache:tomcat:6.0.19

* cpe:/a:apache:tomcat:6.0.20

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Permissions, Privileges, and Access Control (CWE-264)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2901